Announcement-ID: PMASA-2011-1
Date: 2011-02-08
Path disclosure when some files have been removed.
When the files README, ChangeLog or LICENSE have been removed from their original place (possibly by the distributor), the scripts used to display these files can show their full path, leading to possible further attacks.
We consider this vulnerability to be non critical.
For the error messages to be displayed, php.ini's error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).
The 2.11.x and 3.3.x versions are affected.
Upgrade to phpMyAdmin 3.3.9.1 or newer (2.11.11.2 or newer for the older family) or apply the related patch listed below.
Thanks to MustLive from Websecurity for reporting this issue.
Assigned CVE ids: CVE-2011-0986
The following commits have been made to fix this issue:
The following commits have been made on the 3.3 branch to fix this issue:
The following commits have been made on the 2.11 branch to fix this issue:
For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.